# 30, 60, 90 day plan: <company>, from <as-of date>

Built from the audit findings with the rules in references/prioritisation-and-plan.md. The audit executed none of it. Each item is a proposal that its owner accepts, schedules or declines with a date.

## Principles

- Class 1 first: customer harm and data used without permission.
- Dependencies before automation: identity before new segments, eligibility before more automated sends, measurement fixes before the consolidation decisions that rely on them.
- Decisions before deadlines: every review-by date inside 90 days has an item in the right window.
- Capacity: when the first window holds more than the owners can take, move class 4 and 5 items out first. Never move class 1.

## Item format

- P<n> <change in one line>
  - Findings: <IDs>
  - Owner: <role>
  - Dependencies: <plan IDs, or none>
  - Acceptance test: <observable result>
  - Evidence to attach: <file, screenshot, test record IDs, invoice>
  - Rollback: <how, and what rollback does not undo>
  - Decision or notice deadline: <date, or none>
  - Status: <proposed | agreed | in progress | done | risk accepted until date>

## Days 0 to 30 (<as-of> to <as-of plus 30 days>)

Class 1 and 2 FAILs, review-by dates inside 30 days, missing order forms, and quick wins (one setting or seat, reversible, no dependency, owner available, no customer-facing change, no contract action). A contract action is written notice, an order-form change or a reduction at a term boundary; cancelling a self-serve monthly subscription reducible any time is a quick win once the owner confirms which one stays.

- P1 <change>
  - Findings: <IDs>
  - Owner: <role>
  - Dependencies: none
  - Acceptance test: <result>
  - Evidence to attach: <evidence>
  - Rollback: <how>
  - Decision or notice deadline: <date>
  - Status: proposed

## Days 31 to 60

Flow, identity and tracking repairs; replacement tests that must finish before a decision; review-by dates from day 31 to day 60.

- P<n> <change>

## Days 61 to 90

Cutovers that passed their tests; retirements (access, tokens, webhooks, embedded forms, DNS records, notice, next invoice); the new-tool intake rule; re-tests of closed FAILs; review-by dates from day 61 to day 90.

- P<n> <change>

## Roadmap (quarterly gates)

- <Quarter>: <larger project>
  - Gate: <what must be true before it starts>
  - Owner: <role>

## Governance items

- New-tool intake rule. Every request names: the capability gap, the existing tool evaluated, the accountable owner, the cost meter, the data it will hold, the DPA and the security review, the exit route and the trial review date.
- Review cadence: a renewal review at each review-by date; a monthly re-run of stack_inventory.py on fresh spend and identity exports; a quarterly access review for critical tools; a full audit yearly, or after an acquisition, a new product line or a platform migration.
- Ownership gaps: <tools with an unknown owner or no backup, and who will name one by when>

## Savings tracker

- <tool>: cash through <date> <amount>; run-rate <amount> from <date>; capacity <hours>; invoice check on <date>

## Follow-up

- Re-run the three scripts on fresh exports on <date> and compare the summary lines and listed IDs with this audit.
- Re-test every closed FAIL on <date> with its own acceptance test.